winbindd: Call set_dc_type_and_flags on the internal domain

This allows the AD DC to be picked up correctly and gives the correct DNS name.

To ensure no confusion, we also always init it with the full DNS name.

It also means that, aside from the BUILTIN domain the initialized
flag is set only in one place, which will help when we add more details
to the domain structure in the future.

This in turn allows kerberos authentication against winbindd on the AD DC.

Andrew Bartlett

Change-Id: Idc829cfe5f2e867c87107b49275b17f294821dcd
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
foo

Change-Id: Ia6acb45ff8c028af10bfb4eb1729941924f494ed
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source3/winbindd/winbindd_cache.c b/source3/winbindd/winbindd_cache.c
index 9c4b5bd4e82bd884f414ba335ddf1303230c0bcb..264e75c8bdf872da02d94d73773fc150135c7f08 100644 (file)
--- a/source3/winbindd/winbindd_cache.c
+++ b/source3/winbindd/winbindd_cache.c
@@ -120,13 +120,15 @@ static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 
        if (domain->internal) {
                domain->backend = &builtin_passdb_methods;
-               domain->initialized = True;
+       }
+
+       if (dom_sid_equal(&domain->sid, &global_sid_Builtin)) {
+               domain->initialized = true;
        }
 
        if (strequal(domain->name, get_global_sam_name()) &&
            sid_check_is_our_sam(&domain->sid)) {
                domain->backend = &sam_passdb_methods;
-               domain->initialized = True;
        }
 
        if ( !domain->initialized ) {

diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index be13a57e9eafdaae625b9d493c20dee52719b30b..93d15edd46be3e248aae3eca0bf6722cfeeaeed9 100644 (file)
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -80,6 +80,8 @@
 #include "../libcli/smb/smbXcli_base.h"
 #include "lib/param/loadparm.h"
 #include "libcli/auth/netlogon_creds_cli.h"
+#include "auth.h"
+#include "rpc_server/rpc_ncacn_np.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
@@ -1607,6 +1609,50 @@ done:
        return ret;
 }
 
+NTSTATUS wb_open_internal_pipe(TALLOC_CTX *mem_ctx,
+                              const struct ndr_interface_table *table,
+                              struct rpc_pipe_client **ret_pipe)
+{
+       struct rpc_pipe_client *cli = NULL;
+       struct auth_session_info *session_info = NULL;
+       NTSTATUS status;
+
+       status = make_session_info_system(mem_ctx, &session_info);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(0, ("open_lsa_pipe: Could not create auth_session_info: %s\n",
+                         nt_errstr(status)));
+               return status;
+       }
+
+       /* create a lsa connection */
+       if (lp_parm_bool(-1, "winbindd", "use external pipes", false)) {
+               status = rpc_pipe_open_interface(mem_ctx,
+                                                table,
+                                                session_info,
+                                                NULL,
+                                                winbind_messaging_context(),
+                                                &cli);
+       } else {
+               status = rpc_pipe_open_internal(mem_ctx,
+                                               &table->syntax_id,
+                                               session_info,
+                                               NULL,
+                                               winbind_messaging_context(),
+                                               &cli);
+       }
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(0, ("open_internal_pipe: Could not connect to %s pipe: %s\n",
+                         table->name, nt_errstr(status)));
+               return status;
+       }
+
+       if (ret_pipe) {
+               *ret_pipe = cli;
+       }
+
+       return NT_STATUS_OK;
+}
+
 static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
                                   struct winbindd_cm_conn *new_conn)
 {
@@ -1893,12 +1939,12 @@ static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
        NTSTATUS result;
 
        /* Internal connections never use the network. */
-       if (domain->internal) {
-               domain->initialized = True;
-               return NT_STATUS_OK;
+       if (dom_sid_equal(&domain->sid, &global_sid_Builtin)) {
+               return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
        }
 
-       if (connection_ok(domain)) {
+       /* Still ask the internal LSA and SAMR server about the local domain */
+       if (domain->internal || connection_ok(domain)) {
                if (!domain->initialized) {
                        set_dc_type_and_flags(domain);
                }
@@ -1918,7 +1964,7 @@ static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
 
 NTSTATUS init_dc_connection(struct winbindd_domain *domain)
 {
-       if (domain->internal) {
+       if (dom_sid_equal(&domain->sid, &global_sid_Builtin)) {
                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
        }
 
@@ -2081,7 +2127,7 @@ static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
        union dssetup_DsRoleInfo info;
        union lsa_PolicyInformation *lsa_info = NULL;
 
-       if (!connection_ok(domain)) {
+       if (!domain->internal && !connection_ok(domain)) {
                return;
        }
 
@@ -2094,9 +2140,15 @@ static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
 
        DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
 
-       status = cli_rpc_pipe_open_noauth(domain->conn.cli,
-                                         &ndr_table_dssetup,
-                                         &cli);
+       if (domain->internal) {
+               status = wb_open_internal_pipe(mem_ctx,
+                                              &ndr_table_dssetup,
+                                              &cli);
+       } else {
+               status = cli_rpc_pipe_open_noauth(domain->conn.cli,
+                                                 &ndr_table_dssetup,
+                                                 &cli);
+       }
 
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
@@ -2145,9 +2197,14 @@ static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
        }
 
 no_dssetup:
-       status = cli_rpc_pipe_open_noauth(domain->conn.cli,
-                                         &ndr_table_lsarpc, &cli);
-
+       if (domain->internal) {
+               status = wb_open_internal_pipe(mem_ctx,
+                                              &ndr_table_lsarpc,
+                                              &cli);
+       } else {
+               status = cli_rpc_pipe_open_noauth(domain->conn.cli,
+                                                 &ndr_table_lsarpc, &cli);
+       }
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
                          "PI_LSARPC on domain %s: (%s)\n",
@@ -2267,9 +2324,9 @@ static void set_dc_type_and_flags( struct winbindd_domain *domain )
 {
        /* we always have to contact our primary domain */
 
-       if ( domain->primary ) {
+       if ( domain->primary || domain->internal) {
                DEBUG(10,("set_dc_type_and_flags: setting up flags for "
-                         "primary domain\n"));
+                         "primary or internal domain\n"));
                set_dc_type_and_flags_connect( domain );
                return;         
        }

diff --git a/source3/winbindd/winbindd_proto.h b/source3/winbindd/winbindd_proto.h
index 33a70821b1f24bdf102c134717ea35bdf09ea06e..65553f70ed232798398b3aa9ac490176cb8d788b 100644 (file)
--- a/source3/winbindd/winbindd_proto.h
+++ b/source3/winbindd/winbindd_proto.h
@@ -163,6 +163,11 @@ void winbind_msg_domain_online(struct messaging_context *msg_ctx,
 
 void set_domain_offline(struct winbindd_domain *domain);
 void set_domain_online_request(struct winbindd_domain *domain);
+
+struct ndr_interface_table;
+NTSTATUS wb_open_internal_pipe(TALLOC_CTX *mem_ctx,
+                              const struct ndr_interface_table *table,
+                              struct rpc_pipe_client **ret_pipe);
 void invalidate_cm_connection(struct winbindd_cm_conn *conn);
 void close_conns_after_fork(void);
 NTSTATUS init_dc_connection(struct winbindd_domain *domain);

diff --git a/source3/winbindd/winbindd_samr.c b/source3/winbindd/winbindd_samr.c
index 8a717008086574b5772834da60de4170ef1bb2f1..888ce648a4eec303403b480b374abfec6d48fd03 100644 (file)
--- a/source3/winbindd/winbindd_samr.c
+++ b/source3/winbindd/winbindd_samr.c
@@ -39,50 +39,6 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
 
-static NTSTATUS open_internal_samr_pipe(TALLOC_CTX *mem_ctx,
-                                       struct rpc_pipe_client **samr_pipe)
-{
-       struct rpc_pipe_client *cli = NULL;
-       struct auth_session_info *session_info = NULL;
-       NTSTATUS status;
-
-       status = make_session_info_system(mem_ctx, &session_info);
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(0, ("open_samr_pipe: Could not create auth_session_info: %s\n",
-                         nt_errstr(status)));
-               return status;
-       }
-
-       /* create a samr connection */
-       if (lp_parm_bool(-1, "winbindd", "use external pipes", false)) {
-               status = rpc_pipe_open_interface(mem_ctx,
-                                                &ndr_table_samr,
-                                                session_info,
-                                                NULL,
-                                                winbind_messaging_context(),
-                                                &cli);
-       } else {
-               status = rpc_pipe_open_internal(mem_ctx,
-                                               &ndr_table_samr.syntax_id,
-                                               session_info,
-                                               NULL,
-                                               winbind_messaging_context(),
-                                               &cli);
-       }
-
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(0, ("open_samr_pipe: Could not connect to samr_pipe: %s\n",
-                         nt_errstr(status)));
-               return status;
-       }
-
-       if (samr_pipe) {
-               *samr_pipe = cli;
-       }
-
-       return NT_STATUS_OK;
-}
-
 NTSTATUS open_internal_samr_conn(TALLOC_CTX *mem_ctx,
                                 struct winbindd_domain *domain,
                                 struct rpc_pipe_client **samr_pipe,
@@ -92,7 +48,7 @@ NTSTATUS open_internal_samr_conn(TALLOC_CTX *mem_ctx,
        struct policy_handle samr_connect_hnd;
        struct dcerpc_binding_handle *b;
 
-       status = open_internal_samr_pipe(mem_ctx, samr_pipe);
+       status = wb_open_internal_pipe(mem_ctx, &ndr_table_samr, samr_pipe);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -124,56 +80,13 @@ NTSTATUS open_internal_samr_conn(TALLOC_CTX *mem_ctx,
        return result;
 }
 
-static NTSTATUS open_internal_lsa_pipe(TALLOC_CTX *mem_ctx,
-                                      struct rpc_pipe_client **lsa_pipe)
-{
-       struct rpc_pipe_client *cli = NULL;
-       struct auth_session_info *session_info = NULL;
-       NTSTATUS status;
-
-       status = make_session_info_system(mem_ctx, &session_info);
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(0, ("open_lsa_pipe: Could not create auth_session_info: %s\n",
-                         nt_errstr(status)));
-               return status;
-       }
-
-       /* create a lsa connection */
-       if (lp_parm_bool(-1, "winbindd", "use external pipes", false)) {
-               status = rpc_pipe_open_interface(mem_ctx,
-                                                &ndr_table_lsarpc,
-                                                session_info,
-                                                NULL,
-                                                winbind_messaging_context(),
-                                                &cli);
-       } else {
-               status = rpc_pipe_open_internal(mem_ctx,
-                                               &ndr_table_lsarpc.syntax_id,
-                                               session_info,
-                                               NULL,
-                                               winbind_messaging_context(),
-                                               &cli);
-       }
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(0, ("open_lsa_pipe: Could not connect to lsa_pipe: %s\n",
-                         nt_errstr(status)));
-               return status;
-       }
-
-       if (lsa_pipe) {
-               *lsa_pipe = cli;
-       }
-
-       return NT_STATUS_OK;
-}
-
 static NTSTATUS open_internal_lsa_conn(TALLOC_CTX *mem_ctx,
                                       struct rpc_pipe_client **lsa_pipe,
                                       struct policy_handle *lsa_hnd)
 {
        NTSTATUS status;
 
-       status = open_internal_lsa_pipe(mem_ctx, lsa_pipe);
+       status = wb_open_internal_pipe(mem_ctx, &ndr_table_lsarpc, lsa_pipe);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }

diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
index a00fe14e85ccf0bce75a5076226b70e1937066ab..4e8ab92c00a242f52875ce754d5c4ce6c15d73fc 100644 (file)
--- a/source3/winbindd/winbindd_util.c
+++ b/source3/winbindd/winbindd_util.c
@@ -576,11 +576,7 @@ enum winbindd_result winbindd_dual_init_connection(struct winbindd_domain *domai
                fstrcpy(domain->dcname, state->request->data.init_conn.dcname);
        }
 
-       if (domain->internal) {
-               domain->initialized = true;
-       } else {
-               init_dc_connection(domain);
-       }
+       init_dc_connection(domain);
 
        if (!domain->initialized) {
                /* If we return error here we can't do any cached authentication,
@@ -621,9 +617,13 @@ bool init_domain_list(void)
 
        /* Local SAM */
 
-       (void)add_trusted_domain(get_global_sam_name(), NULL,
-                                   &cache_methods, get_global_sam_sid());
-
+       if ( role == ROLE_ACTIVE_DIRECTORY_DC ) {
+               (void)add_trusted_domain(get_global_sam_name(), lp_dnsdomain(),
+                                        &cache_methods, get_global_sam_sid());
+       } else {
+               (void)add_trusted_domain(get_global_sam_name(), NULL,
+                                        &cache_methods, get_global_sam_sid());
+       }
        /* Add ourselves as the first entry. */
 
        if ( role == ROLE_DOMAIN_MEMBER ) {